Who runs this site
Sanctity, Amsterdam. For any question about your data, write to us.
Answering without an account
When you answer a question, make a Signal call or finish a game in the Lab, your browser receives a random identifier in a cookie, stored in that browser. Until you create an account or log in, it is not linked to your name or email. It lets the site show you your earlier answers and count each person once. We store your answers, the reason you chose (if you chose one), your Signal calls, your game rounds and how long you spent reading before answering.
Nothing you give is shown on the site with your name. Inside the service, your contributions are kept together under your browser’s random identifier, and with your account once you create one, so we can tell which contributions came from the same browser or account. What you can change depends on what you gave. An answer to one of the eight questions can be changed by answering again, or taken back from your record at any time, and it leaves the counts. A Lab play kept on your record can be removed from it at any time. A Signal call is final: it cannot be changed or taken back from your record, because calls are checked later against what happens.
Before The Crossing starts you choose “Practice only” or “Add my choices to the public count”. If you chose to add them (and have not told us you are under 18), when you finish we store the crossings you were shown, what you chose in each, how long each choice took, the principle you picked at the end (if you picked one) and the profile our server works out from those choices. It is kept under the same random identifier, never with a name, and counts toward the Sanctity players' average. You can remove a play from your record at any time, and it leaves the average with it. If you chose “Practice only”, nothing from the game is kept or counted. While you play, our server keeps the game so far (the crossings dealt to you and your choices) because it picks each next crossing; that is deleted a day after your last move.
When you play Emergency Room our server deals every patient, so while you play it keeps the shift so far: the patients dealt, your choices, how long each took, and the details you gave before the shift (gender for your doctor, age range, region and whether you work in healthcare, each with “prefer not to say”), which the game uses to put you and your family on the trolley. A shift is deleted a day after your last move. If you chose “Add my choices to the public count” and told us you are 18 or over, we keep one record, with no name or email: your choices, the patients you were shown, those details and the triage profile our server works out. It is kept under the browser's random identifier, and you can remove it from your record at any time. Your choices are also added, as counts only, to what other players chose for the same two patients.
When you play The Charity Game our server deals every choice, so while you play it keeps the game so far: the choices dealt to you, what you gave, how long each took, and the region you gave before the ride (if you gave one). If you chose “Practice only”, or you are under 18, or you did not give an age of 18 or over, the game is deleted when it ends. If you chose “Add my choices to the public count” and told us you are 18 or over, we keep one record, with no name or email: your gifts, your answers to the questions before the ride (rider, age range, region and how often you give, each with “prefer not to say”), what you said guided you, your city budget and the giving profile our server works out. It is kept under the browser's random identifier, and you can remove it from your record at any time. A game you do not finish is deleted a day after your last move.
When you play Healthy Basket our server deals every basket, so while you play it keeps the game so far: the baskets dealt, which one you called healthier, how long each call took, the diet you chose, which of six food groups your region falls in (South Asia is a group of its own), whether you play on a phone, and what you said guided you at the end. Nothing about you goes with the game until it ends. If you chose “Add my choices to the public count” and told us you are 18 or over, we keep one record: every basket and call, the beliefs our server works out from them, and your answers to the questions before the game (gender, age range, region and diet, each with “prefer not to say”). It is kept under the browser’s random identifier, never with a name or email, and you can remove it from your record at any time. Otherwise nothing is kept: a finished game is deleted an hour after it ends, and a game you do not finish a day after your last move.
When you play Standing Orders, The Gorge, The Watch, The Messenger, Driftwood or The Quartermaster our server deals every card, so while you play it keeps the game so far: the cards dealt, your answers, how long each took, whether you play on a phone, and the model’s working numbers. Nothing about you goes with the game until it ends. If you chose “Add my choices to the public count” and told us you are 18 or over, we keep one record: every card and answer, what our server reads from them, your answer to the last question, about the game’s value (if you answered it), and your answers to the questions before the game (gender, age range and region, each with “prefer not to say”). It is kept under the browser’s random identifier, never with a name or email, and you can remove it from your record at any time. Otherwise nothing is kept: a finished game is deleted an hour after it ends, and a game you do not finish a day after your last move.
When you play The World Budget: Today’s Town our server works out every year of your town, so while you play it keeps the town so far: your points, the cards shown and chosen each year, and the town’s hidden luck. Nothing about you goes with it. If you told us, in the questions every Lab game asks once, that you are 18 or over and chose “Add my choices to the public count”, your town of the day is added when you finish it; practice towns are not. Then we keep one record: your two splits of points, each year’s cards and choices, how long you took, which evidence sheets you opened, the result, and your answers to those questions (gender, age range and region, each with “prefer not to say”). It is kept under the browser’s random identifier, never with a name or email, and you can remove it from your record at any time. A town that is not added is deleted an hour after it ends, and one you do not finish a day after your last move. Your streak and saved towns stay in your browser only.
Before The People’s Forecast starts you choose “Practice only” or “Add my choices to the public count”. With “Practice only” the game plays as normal and none of your answers or predictions are kept. If you chose to add them, our server keeps your answers under a random identifier made by your browser, never with a name, email or IP address: each call, whether it was right, how long it took, how sure you were, and the details you gave before the first game (your region, the country you know best and your age band, each with “prefer not to say”). Your 2030 predictions are kept with a receipt code and the date our server received them, so anyone with the code can check them later. If you tell us you are under 18, the game plays as normal and none of your answers are kept. A game you leave unfinished is deleted a day after your last answer. Leagues are for players aged 18 and over: if you start or join one, the display name you choose is shown on that league’s table, and names are checked once a day. Public results are totals only, never one player’s answers.
To stop one script from posing as many people, the site counts how many different people answer from one network each day. That count is kept in memory only, against the network your connection comes from, and is never written to the database or joined to your answers. If it holds your answer for a check, the answer itself is stored exactly like any other, with a note that it is waiting.
Optional details
After eight contributions you may share an age range, a country and a gender. Each is optional and "prefer not to say" stores nothing. These details are kept with your answers under the random identifier. They are used for one thing: your record, and only yours, shows how people in the same country, age range or gender answered, once at least 20 of them have. A group shows once at least 20 people in it have answered. That limits what a group's figures can reveal about any one person; it is not a promise that no one could ever be identified. Nothing is published by group. They are never shown next to your name and are never sent to advertising or analytics tools.
Once you have answered all eight questions we ask, once, which country you are answering from. It is chosen from a list and is optional. If you give it, it appears in the live feed of answers as "someone in" that country, never with your name, and the number of countries is shown beside the other counts.
Accounts and signatures
If you create an account we store your name, your email address and a securely hashed password (never the password itself). When you create an account or log in, the answers, calls and games made in that browser are linked to your account in our database, so your record can follow you to other devices. That link is private: your name appears with an answer publicly only when you choose to sign that specific answer. The emails we send you (a confirmation link, a password reset link) wait in a queue until they have gone; once one is sent, or too late to be of use, its text is deleted and only the first letter of the address and its domain are kept.
Messages and applications
When you send a message or apply for a role, we store what you send so we can reply.
Usage events
We count a small set of events, such as a story being viewed or an answer being shared, in our own database. These events carry no answer text and no personal details.
Cookies and analytics
The site needs one cookie of its own, to keep your answers yours. With your permission we also use Google Analytics to count visits and see which pages people use. It does not load until you say yes, saying nothing counts as no, and "Cookie settings" at the foot of every page lets you change your answer. We count how many people say yes and how many say no, with nothing that says who.
What we never do
We do not sell personal data. We do not use advertising trackers. We do not show your name on an answer you did not sign.
Who sees the results
The people who run Sanctity see totals: how many chose each answer, each reason and each Signal explanation. There is no export of one person's answers, not even under a code name.
Copies
On the live site, a private copy of the database is made every day and the last seven are kept. Before the site's software changes how data is stored, or before a change to many records at once, one more copy is made and kept for 14 days, so a mistake can be undone. Access to the copies is limited to the service that runs the site.
Where it is stored
In one database run by Sanctity on Fly.io, in its Amsterdam region, with the daily copies described above on the same private disk.
Your rights
Your record shows every answer you have given.
Taking an answer back. On your record, each answer has a "take it back" control, and there is one for all your answers at once. The first click asks you to confirm; the second removes it. You do not need to write to us or have an account. From that moment the answer and its history are in no count, on no record and in no export. We keep one line saying that an answer was withdrawn and when, with nothing about who you are or what you said, so we can say how many withdrawals there have been.
What taking it back cannot reach at once. A copy of the database made before you took an answer back still holds it until that copy is deleted: within seven days for the daily copies, and within 14 days for a copy made before a change. If we ever restore from a copy, we take your answers back again before the site is used.
Everything else. For anything the site does not let you do yourself, such as closing an account, correcting your details or getting a copy of what we hold, contact us and we will help.
The GDPR gives you further rights, including the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.